Low · published January 16, 2026
⚠️ An RPC call with a bad signature could unintentionally expose your HMAC secret, like whispering your credit card number to a stranger! Imagine you're at a party, and every time someone hands you a drink with a monogrammed cup, you accidentally spill the secret ingredient while complaining about the drink's flavor. That's how logging sensitive data in invalid requests works! In this case, any invalidly signed RPC request could leak your shared HMAC secret into logs, making it visible to anyone who can read them. While it’s low severity, the risk of unauthorized RPC calls increases if the secret is compromised—potentially allowing attackers to forge calls that shouldn't be made.
Imagine you're at a party, and every time someone hands you a drink with a monogrammed cup, you accidentally spill the secret ingredient while complaining about the drink's flavor. That's how logging sensitive data in invalid requests works! This vulnerability in RustFS versions 1.0.0-alpha.1 to 1.0.0-alpha.79 results from logging sensitive data in response to invalid RPC signatures, which could lead to unauthorized access through forged RPC calls.
In this case, any invalidly signed RPC request could leak your shared HMAC secret into logs, making it visible to anyone who can read them. While it’s low severity, the risk of unauthorized RPC calls increases if the secret is compromised—potentially allowing attackers to forge calls that shouldn't be made. Upgrade RustFS to version 1.0.0-alpha.80 or later to patch this vulnerability. Additionally, review your logging practices to ensure secrets are not exposed in logs during error handling. It's also a good idea to monitor access logs for any suspicious activity. You've got this! With a few updates, your system will be as secure as Fort Knox! 🛡️